• We have updated the guidelines regarding posting political content: please see the stickied thread on Website Issues.

ID Cards / Identification Cards

And as for the poor bastards who do the work

The homes of freelance IT workers contracted to work for the big five ID card companies could be entered and searched without a warrant, it emerged last night.

Staff, consultants and contractors hired by IBM, Fujitsu, CSC, Thales and EDS to work on the UK-wide project were said to be targeted by the proposal in a Home Office paper, seen by CUK.

Its eleven ‘confidential’ pages were leaked to a critic of the £5.4bn programme, which blasted the plan to raid its workers’ homes without a police warrant as “quite extraordinary.”

Phil Booth, of NO2ID, also seemed to doubt whether the scheme’s staff had been told that their homes could be entered and searched at any time over the next 25 years, as the paper states.

He told CUK: "This appears to be an attempt to tighten up on certain types of data breaches amongst contractors and sub-contractors."

"Once a company signs an actual [NIS] contract, this Non-Disclosure Agreement will be superceded by the terms of the new contract.

"But it is pretty inconceivable that the conditions would be any more relaxed for actual contractors, rather than prospective ones."

The NDA appears to be aimed at minimising the risk of ID project staff leaking damaging details about building its central computer - the national identity register.

In line with this, the Home Office said the measure was intended to keep the identity scheme secure, but would not introduce new legal powers, the Sunday Times reported.

"It is incredibly heavy-handed," Mr Booth said of the proposal. "Foregoing the right of warrant for search of domestic premises for 25 years is a major step, however much the Home Office tries to play it down."

Officials appear to want companies and staff to “contract out” of legal rights not to have security officers “trampling” through their premises without a warrant, said civil rights group Liberty.

Director Shami Chakrabarti reportedly added that the government’s proposals signalled it was simply “not enough” anymore to “constantly legislate our liberty away” transparently.

She said that the contents of the leaked paper - authored, ironically, to stop leaks about ID cards - revealed the extent of “Home Office arrogance and contempt for individual privacy.”

Under a section entitled Audit Rights, the NDA states:" The [ID card] company and each of its individual recipients [staff, contractors, consultants, advisors] shall permit the Authority [government]...to gain entry and access to the premises and any and all records, computers and other property of the company and such individual recipients containing or including any Natitional Identity Scheme (NIS) informaiton".

Meanwhile, the government is inviting the public to respond to a consultation on secondary legislation for ID cards, which proposes fines for non-compliant card-holders of up to £1,000.

Non-compliance includes not reporting damage to the card or failing to tell authorities of a change of address within three months, with recurrent penalties for repeat offenders.

http://www.contractoruk.com/news/004107.html

A hideous step.
 
A touch of irony here 8) :

1978: Labour opposed ID cards to curb illegal immigration
Kaya Burgess

The Labour administration in 1978 believed the introduction of ID cards would be “unacceptable” and “objectionable” in the fight against illegal immigration, confidential documents released today show.

The comments were in a draft statement due to be given to the Commons by Merlyn Rees, the Home Secretary, who wrote that the introduction of identity cards “would require major changes in practices and powers reaching far beyond immigration control”.

He added: “In the past such changes have been contemplated only in war: the Government does not believe they could be justified on immigration grounds alone.”

The comments were later edited out of the final speech he delivered to the House, as a struggling Labour Government tried to resist the calls from Opposition leader Margaret Thatcher for more draconian measures to tackle illegal immigration.

In a secret discussion between Prime Minister Callaghan and the Whips on March 8 1978, a Downing Street aide wrote: “It was claimed that many Asian immigrants were very frightened.

“There was bitter opposition to the tactics adopted by Mrs Thatcher... and that resentment should be exploited by the Government.”

Ministers stuck by their pledge not to introduce quotas on immigration as they did not want the “objectionable” measure of requiring everyone to carry identification papers.

The confidential Government documents also discussed ways to expose “the fraudulent nature of Mrs Thatcher’s approach”, although a personal note written by Mr Callaghan warned that the Government’s response to Select Committee recommendations was too lacklustre.

He said: “We seemed to be accepting few recommendations – mostly ones to do nothing.”

http://www.timesonline.co.uk/tol/news/p ... 415760.ece
 
And this shows just how not open to abuse these uber databases are. It's not like an ex senior copper would use it to try and find his lost dog, is it? *cough cough cough*

EXCLUSIVE: Ex- West Yorkshire police chief arrested

A retired top policeman has been arrested over suspected misuse of data – in a case involving a missing dog belonging to an ex Leeds police chief.
Former Assistant Chief Constable Andy Brown was questioned by West Yorkshire Police professional standards department over the case of former Chief Supt Elizabeth Preece's missing spaniel.

The investigation looked at how the address of a woman, said to have been been in possession of a dog which resembled the missing dog, was obtained from her number plate. A visit was made to the woman's home and this led to a complaint to the police.

A West Yorkshire Police spokesman said police had received a report of the alleged theft of a dog.

An inquiry was launched by the professional standards department into related matters and a man – not a serving officer – was arrested over alleged data protection matters. He has been released on bail. The inquiry is ongoing – and the dog has not been found.

When a reporter called at the home of Ms Preece she said: "I don't know whether I should speak about it, it has been a rather difficult time." She declined to comment further.

Mr Brown was unavailable for comment.

Before being made ACC, Mr Brown was a senior member of the West Yorkshire CID and involved in a number of murder investigations, including those into the murders of retired miner Don Herbert, 64, and Paul Hemingway, 49, who lived in Sharlston and Normanton. After retiring he worked as a security adviser and private investigator.

Ms Preece had commanded the Killingbeck, Leeds, and Wakefield divisions.

Serving police officers can access drivers' DVLA records as long as it is in the line of duty.

Normally civilians or retired police would not have access, however a range of public and private sector organisations have been given access as long as they could prove they have "reasonable cause" to obtain the information.

Among these have included investigation of cars parked illegally, tracing company assets and identifying vehicles driven off without paying for goods or services.

http://www.yorkshireeveningpost.co.uk/n ... 4892758.jp
 
Looks like we'd all better get used to that, according to the latest NO2ID newsletter. It seems the Data Protection Act is being dismantled at this moment.

It appears the Westminster government is rushing through a lovely bit of legislation which will mean any minister / govt. department will be able to to make 'Information Sharing Orders', in order to use information obtained for one purpose to be used for another. Even the supposedly confidential stuff.

So, everything ever recorded about you anywhere becomes freely available to any (official - for the moment, see below) body. That's not just 'government'/ crime / tax/ benefit type information, the changes allow for data trafficking between government and private companies (NHS? What about banks, would it include them do you think?) and even foreign governments. :shock:

The important bit is apparently hidden away in the Coroners and Justice Bill, Clause 152. I'm off to see what exactly it says, because this is not looking good for civil liberties in Britain!
 
Yesterday, Radio 4's Today had a report on data protection and the general view was there isn't much regard for protecting data within government itself.

There was a brief review of the blunders we've already covered here but it's worth making the point again about the statement that the drive is on the amount of data officials collect and not its accuracy.
On this, there was a report from a woman who'd been asking the NHS to get her postcode right for years. She and a neighbour have to swap correspondance. Rather nasty if you DON'T get a letter from them saying you need an operation urgently.
 
Here's a little more detail on my previous post.



Millions of records are inaccurate
Thursday, January 22, 2009

All but one government department has no system in place to correct data errors, an investigation has revealed.

Tom Ilube, the chief executive of the identity management company Garlik, revealed that just one department has a procedure in place to correct errors within its databases. Ilube discovered this after submitting a Freedom of Information request to each central government department asking if they have a system in place to correct data errors.

The education watchdog Ofsted is the only organisation to get a clean bill of health, with major government departments like the Cabinet Office and the Department of Health admitting to no procedure in place.

Speaking on BBC Radio 4's Today programme, he said: "When you see it written down in department after department, 'no we haven't been audited, no we don't have any written policies, no we don't have a budget, no there are no statistical information,' it does take you aback.

"What it says to me is that these departments are not taking looking after personal information seriously. [Government is] really getting to dangerous levels of complacency in [its] ability to look after our personal information."

Full thing here...

http://www.publicservice.co.uk/news_story.asp?id=8324
 
More data going walkabout:

Hackers have stolen the personal details of millions of job seekers in one of the biggest cases of data theft in Britain, it emerged.

The recruitment giant Monster said hackers now held confidential information contained on its database, including user names, passwords, telephone numbers, email addresses and "some basic demographic data".

The company said the stolen information did not include CVs, national insurance numbers or personal financial data.

It is thought 4.5 million people are registered with the monster.co.uk website and could be affected by the breach, which, if confirmed, will be the largest data loss since the details of 25 million child benefit recipients went missing in 2007.

In a statement issued on Friday, signed by Monster's senior vice president Patrick Manzo, customers were told to change their passwords when they next log on to the website.

The statement said hackers could use email addresses to "phish" for further information.

The incident is the second serious data breach to hit the company in 18 months, according to Computer Weekly magazine.

The earlier attack was followed by a widespread phishing campaign.

It is also feared that hackers could access users' bank accounts as some people use the same password and email address for online banking.

The statement said the company had launched an investigation and had taken "corrective steps".

http://latestnews.virginmedia.com/news/ ... ons_hacked
 
I was watching the news last night....did I really hear it right? Was one of the disgraced members of the House of Lords given cash to promote legislation changes by the company Experian - a key player in the steamrolling ID Card/ database system? It seems so.

It's been debatable whether the ID Card scheme is a true conspiracy theory but when such large amounts of cash are alleged to have been handed over at a tea and cake ceremony, it seems those with a vested interest in this hideous piece of legislation are a step ahead in getting what they want.

Was this the amendment that Experian bribed Lord Taylor to make?
leave a comment »

From the Guardian, September 2002:

Privacy International gave Experian its “Big Brother” award for the company’s intense lobbying campaign to preserve its access to electoral roll data. Last year agencies such as Experian were banned from taking details off the electoral roll after a High Court judge ruled that a council taxpayer in Wakefield would have had his human rights violated if the register was passed on to organisations for commercial gain. But the ban was lifted after the agencies protested that the fight against terrorism and money laundering would be hampered if banks and the police were not able to verify the addressess of customers opening accounts.

From The Telegraph:


Lord Taylor: “Experian are the company. They have a terrific amount of intelligence and information. They are the people who advise banks on your credit worthiness and so on. For example I’ve been working with them on amending a statute that’s coming out, or was coming out, because I’ve got it delayed now, whereby it was going to be difficult for them to get certain information and so on. So I’ve got that amended and you do it quietly behind the scenes you see.”

http://richardwilsonauthor.wordpress.co ... r-to-make/
 
The first ID cards are here - but no one can read them
Thousands of ID cards have already been issued to foreign residents in the UK as part of the government's £4.7 billion scheme, but no one can read the details stored on them
Murad Ahmed, Technology Reporter

The first biometric ID cards have now been issued in the UK, but no one has a machine that can read them.

Thousands of foreign residents in the UK were the first people to receive ID cards late last year, as the UK government began to implement its £4.7 billion identity card scheme. But the Identity and Passport Service (IPS) has admitted that not one police station, border and immigration point or job centre has a machine that can read the card's biometric chip.

The revelation is the result of a Freedom of Information request made by the technology site silicon.com. According to the report, there is still no firm timetable for the introduction of card readers. A government minister said that it would be up to police forces to decide when to invest in the technology, and that readers would be given to immigration officials over time.

Last November, the first cards were issued to some foreign students and people applying to renew visas issued on the basis of marriage. 50,000 cards are expected to be issued to foreign nationals by April. The Home Office estimates that three million foreign nationals will carry a card by 2010.

The cards store various personal details, such as name, date and place of birth, sex, nationality and whether the holder has access to publicly funded state benefits or services. However, fingerprint scans can only be accessed by reading the biometric chip embedded in the cards.

Shadow home secretary Chris Grayling said: "Once again ministers have shown that the ID card project is absolutely farcical. What is the point of spending billions of pounds on cards that can't be read in the UK?” :twisted:

http://technology.timesonline.co.uk/tol ... 675223.ece
 
Wonder how Westminster will react to this? Nice to see those kind folks up the road standing up for themselves. :)

The Scottish Government has told Westminster it remains "completely opposed" to its plans to roll out identity cards across the UK.

In a letter to the Home Office, Community Safety Minister Fergus Ewing said the cards posed an "unacceptable threat" to civil liberties.

He was responding to a consultation on a code of practice relating to the scheme, which is a reserved matter.

The rules must be in place before the first cards are issued to UK citizens.

Mr Ewing told junior Home Office minister Meg Hillier that money allocated to the scheme would be better spent on more "worthy" causes, such as schools and hospitals.

He said: "Given the current financial climate, the UK Government should have better uses for the vast sums of money being spent on this scheme, which presents an unacceptable threat to citizens' privacy and civil liberties, with little tangible evidence to suggest it will do anything to safeguard against crime and terrorism."

http://news.bbc.co.uk/1/hi/scotland/7890180.stm
 
The shape of things to come..?

Thousands of drivers with photo licence face fines of up to £1,000
Ben Webster, Transport Correspondent

More than 40,000 drivers risk fines of up to £1,000 because they have failed to renew their photocard driving licences.

Many will not have realised that photocards expire after ten years, unlike the old green paper licences, which were valid until the driver was 70. Drivers risk prosecution if stopped by police and may also find that their insurers refuse to pay out on claims they make.

The problem has only emerged in recent months because photocards were first issued in 1998. The first renewals were due in July last year, and between then and the end of January 173,867 photocards expired.

Figures obtained by The Times from the Driver and Vehicle Licensing Agency (DVLA) show that only 128,987 of those drivers have paid £17.50 and sent in new photos to renew their licences, leaving 44,880 outstanding. Some of those drivers will have died or stopped driving, but the vast majority will have failed to notice the small print on their photocards showing the expiry date.

Related Links
Petrol pump prices rise despite fall in oil
Average speed cameras approved for suburbia
The date is listed on the photocard under “4b”. To find out what this means, a driver would have to turn the card over and study even smaller print in an explanatory list, which says “4b licence valid to”.

To add to the confusion, the photocard also shows another “to” date, the day before the driver's 70th birthday. On a standard car licence, this date is listed seven times beside different categories of vehicle, and a driver might assume the photocard is valid until then.

The DVLA said that more than a quarter of drivers due to renew their photocards had not done so, despite being sent reminders. At that rate, more than a quarter of a million drivers could be risking prosecution by the end of the year.

A DVLA spokesman said that drivers who failed to renew their licences “are still entitled to drive but are potentially committing the offence of failing to surrender their licence. Conviction by a court could lead to a fine of up to £1,000.” He added that the ten-year renewal was necessary because faces changed.

The Association of British Insurers said that drivers with out-of-date photocards might not be covered for claims. A spokesman said: “It's probably going to be a case of insurers looking at each case on its merits. If you can show you made efforts to renew your licence that would probably mean the claim is OK. But potentially there could be an issue if you claim on your own policy.”

etc...

http://www.timesonline.co.uk/tol/drivin ... 741199.ece
 
Flights at risk as pilots refuse to accept 'demeaning' ID cards
Ben Webster

Thousands of flights could be cancelled in a dispute between pilots and the Government over the introduction of identity cards.

The British Airline Pilots Association (Balpa) said that its members – 84 per cent of the commercial pilots in Britain – would not co-operate with Home Office plans to make airside workers “guinea pigs” for the cards.

Manchester and London City airports have agreed to take part in an 18-month evaluation of the benefits of identity cards, starting in the autumn. Balpa has told the airports and the Identity and Passport Service that pilots would refuse to take part. This would mean pilots would not be given airside passes and could not fly.

Balpa said that ID cards would have “absolutely no value” for security and that pilots were being coerced into accepting the scheme.

Jim McAuslan, Balpa's general secretary, said: “Forcing pilots to have ID cards is an affront to the people who for years have been, and continue to be, at the forefront in the battle against terrorist outrages.”

No case had been made to demonstrate that ID cards would improve security, Mr McAuslan said, and he asked what would happen if airport workers refused to register for a card.

“Our understanding from the draft regulations is that the individual will be out of a job. This could be an individual who has served his or her country as a service pilot being told they are not now trusted. This is unacceptable and demeaning and we will resist.”

Balpa said in its submission: “It is clear that the Government's staged introduction of biometric identity cards first to overseas students, then to migrant workers and then for aviation workers, represents a way of picking off what are seen as easy targets.”

The Identity and Passport Service said: “Identity cards will benefit workers – not just by improving security, but also by speeding up pre-employment checks and increasing the efficiency of pass-issuing arrangements.”

http://www.timesonline.co.uk/tol/travel ... 741216.ece
 
You couldn't make it up...

Easyjet's rule seems strict and clear: its website and tickets insist "all passengers provide photographic ID at check-in on all flights, including domestic services". So when Arnie Wilson, a magazine editor from Haywards Heath, turned up at Gatwick this month for a flight to Edinburgh only to realise he had neither his passport nor his driving licence, he started to panic.

Check-in staff confirmed the requirements for photo ID but, as Wilson began to make plans to have his passport couriered from home, they offered a helpful alternative - he could make his own.

"They suggested I go to the railway station within the terminal, buy a season ticket and with it get a photocard, which they'd then accept as ID," Wilson said. "In fact, it was even easier and didn't cost a penny. Southern Rail gave me a photocard and sent me upstairs to the public photo booth. I asked if I needed to come back to the ticket office with the photos; they said, no, I should just fill in the card myself then seal down the plastic covering."

Easyjet accepted the DIY identity without question. Wilson added: "Of course I was glad to get the flight but I couldn't believe it - what's the point of Easyjet asking for photo ID if you can get it done like this, and their staff even tell you how to do it? Obviously it was only a domestic flight, but then so were all the planes hijacked on 9/11."

A spokesman for the airline said the requirement for photo ID was introduced to enhance security after the attacks on New York but that rail photocards are acceptable on domestic flights (even though they are not listed as such on the airline's website). "Check-in staff also have extensive training in assessing whether a passenger is a security risk," the spokesman said.

The case highlights the bizarre situation regarding domestic flights in the UK. In 2006 the government passed controversial legislation giving police access to passenger-name records on domestic flights. The move, part of the Police and Justice Act, prompted the then Liberal Democrat home affairs spokesman, Alistair Carmichael, to complain that "the government is building a surveillance infrastructure unparalleled in the free world". Unparalleled, perhaps, but also deeply flawed.

Unlike in the United States, there remains no legal requirement for airlines to ask for photo ID on domestic flights, so the carriers have decided their own policies, which vary significantly. Ryanair demands passport or driving licence, Easyjet accept railcards, and British Airways asks for no photo ID at all. Without photo ID, anyone can fly using a made-up name, at a stroke rendering all security "watch lists" of suspected terrorists - as well as the new legislation - useless.

The Home Office denied there was a problem, arguing that even if suspected terrorists did board domestic flights, airport scanners meant they would be unable to carry on weapons so they "would only have their bare hands".

Source
 
I've run out of things to say about this ongoing shitshower of data abuse...

ID cards database breached by nosey council staff

Local authority staff have viewed sensitive personal records on the Customer Information System (CIS) run by the Department for Work and Pensions (DWP), it emerged today.

The database contains information on nearly everyone in the UK, including all benefit recipients, pensioners and anyone with a national insurance number.

Routine checks have unearthed security breaches by staff at 30 local authorities since 2006, who accessed personal records "without business justification".

The DWP CIS database will form the core of the biometrics-based national identity register, under the government's ID cards programme. DWP data is kept separately from the national identity register data on the CIS system.

Prosecution warning
The DWP warned local authorities in January that it might prosecute staff found accessesing the CIS illegally if the local authorities did not take action.

"Regrettably, checks have identified some local authority staff are committing serious security breaches," the DWP told local authorities in its Housing Benefit and Council Tax Benefit General Information Bulletin on 15 January.

"DWP will support your local authority to ensure appropriate disciplinary or prosecution action is taken, and may consider prosecuting directly under social security legislation," it said.

The bulletin said staff should not access CIS records about or on behalf of their or their colleagues' friends, relatives, partners, or acquaintances. Nor should they share their government passwords with other people.

The DWP said the breaches were all "view only" accesses of personal information stored in CIS records where there was no business justification for the access.

The fuller story of what the weak link in the chain of your personal details are up to here...if you can stomach it.



http://www.computerweekly.com/Articles/ ... -staff.htm
 
A look at the maths:

Spying on 60 million people doesn't add up
Ben Goldacre The Guardian, Saturday 28 February 2009

This week Sir David Omand, the former Whitehall security and intelligence co-ordinator, described how the state should analyse data about individuals in order to find terrorist suspects: travel information, tax, phone records, emails, and so on. "Finding out other people's secrets is going to involve breaking everyday moral rules," he said, because we'll need to screen everyone to find the small number of suspects.

There is one very significant issue that will always make data mining unworkable when used to search for terrorist suspects in a general population, and that is what we might call the "baseline problem": even with the most brilliantly accurate test imaginable, your risk of false positives increases to unworkably high levels, as the outcome you are trying predict becomes rarer in the population you are examining. This stuff is tricky but important. If you pay attention you will understand it.

Let's imagine you have an amazingly accurate test, and each time you use it on a true suspect, it will correctly identify them as such eight times out of 10 (but miss them two times out of 10); and each time you use it on an innocent person, it will correctly identify them as innocent nine times out of 10, but incorrectly identify them as a suspect one time out of 10.

These numbers tell you about the chances of a test result being accurate, given the status of the individual, which you already know (and the numbers are a stable property of the test). But you stand at the other end of the telescope: you have the result of a test, and you want to use that to work out the status of the individual. That depends entirely on how many suspects there are in the population being tested.

If you have 10 people, and you know that one is a suspect, and you assess them all with this test, then you will correctly get your one true positive and - on average - one false positive. If you have 100 people, and you know that one is a suspect, you will get your one true positive and, on average, 10 false positives. If you're looking for one suspect among 1,000 people, you will get your suspect, and 100 false positives. Once your false positives begin to dwarf your true positives, a positive result from the test becomes pretty unhelpful.

Remember this is a screening tool, for assessing dodgy behaviour in a general population. We are invited to accept that everybody's data will be surveyed and processed, because MI5 have clever algorithms to identify people who were never previously suspected. There are 60 million people in the UK, with, let's say, 10,000 true suspects. Using your unrealistically accurate imaginary screening test, you get 6 million false positives. At the same time, of your 10,000 true suspects, you miss 2,000.

If you raise the bar on any test, to increase what statisticians call the "specificity", and thus make it less prone to false positives, then you also make it much less sensitive, so you start missing even more of your true suspects.

Or do you just want an even more stupidly accurate imaginary test, without sacrificing true positives? It won't get you far. Let's say you incorrectly identify an innocent person as a suspect one time in 100: you get 600,000 false positives. One time in 1,000? Come on. Even with these unfeasibly accurate imaginary tests, when you screen a general population as proposed, it is hard to imagine a point where the false positives are usefully low, and the true positives are not missed. And our imaginary test really was ridiculously good: it's very difficult to identify suspects, just from slightly abnormal behavioural patterns.

Things get worse. These suspects are undercover operatives, so they will go out of their way to produce trails which can confuse you.

And lastly, there is the problem of validating your algorithms, and calibrating your detection systems. To do that, you need training data: 10,000 people where you know for sure if they are suspects, to compare your test results against. It's hard to picture how that can be done.

I'm not saying you shouldn't spy on everyday people: I'll leave the morality and politics to those less nerdy than me. I'm just giving you the maths on specificity, sensitivity, and false positives.

http://www.guardian.co.uk/commentisfree ... n-goldacre
 
I refuse to do the math. I have faith in the undeniable fact that the database will be secure....ish.

Prime Minister's health records breached in database attack


By Dan Goodin

Posted in ID, 2nd March 2009 20:40 GMT


Personal medical records belonging to Scotland's rich and powerful - including Prime Minister Gordon Brown and Holyrood's First Minister Alex Salmond - have been illegally accessed in a breach of a national database that holds details of 2.5 million people.

The files contained names, ages, addresses, and occupations of the patients, in addition to medical information such as a list of any current medications and allergies to medicines, according to The Sunday Mail. The records of BBC newswoman Jackie Bird (an earlier version of this story mistakenly referred to her as "newsman") and former Labour leader Jack McConnell and his culture chief wife Bridget were also accessed.

The files were part of the Emergency Care Summary system database, which was established three years ago amid guarantees by the NHS that it was protected using the "highest standards of security." NHS staff generally have to ask patients' permission before reading records except when a patient is unconscious or otherwise unable to give consent.

An NHS Fife doctor has been charged with contravention of the Data Protection Act in the case and appeared on petition at Dunfermline in late December. He made no plea or declaration and isn't scheduled to appear again in court until later this year.

Government officials quoted by The Sunday Mail said the breach didn't appear to be motivated by financial gain and that the only thing linking the victims was that they were famous or had a high public profile.

It's at least the second security breach to personally hit a British government official in as many weeks. UK Justice Secretary Jack Straw recently saw his Hotmail account ransacked by advanced fee fraudsters, who used it to send his contacts a scam email claiming he was in desperate need of financial assistance after being stranded in Nigeria.

http://www.theregister.co.uk/2009/03/02 ... se_breach/

And let's be realistic about this. If the Nigerian scam merchants (who also asked for money to rescue one of their guys in a gone-wrong space mission) can manipulate Jack Straw's account, what could a team of proper hackers do to a central database?
 
A clandestine operation but the principle seems widely accepted by the industry. I really can't see any argument for a centralised database as being a beneficial thing, there's just too much to lose.

I imagine the Unions would have something to say about this too.


'Do not touch' - the covert database that kept union activists out of work• Ian Kerr built blacklist from Droitwich base
• Business ordered to close after files seized in raid
Rob Evans and Phil Chamberlain The Guardian, Friday 6 March 2009 Article history
Information commissioner Richard Thomas: investigation exposed Ian Kerr. Photograph: Michael Stephens/Empics

For years, 66-year-old Ian Kerr has run his business quietly in a first-floor office in the Worcestershire town of Droitwich. There was no nameplate for his premises, which was protected by a green door, and workers in the neighbouring shops either failed to notice him or thought he was a little mysterious.

"Oh yes, Ian," said one. "He has been there for years. We never really knew what he does - probably works for MI5 or something."

Kerr did not work for the security services, but the world he operated in was certainly a private one, and it can be exposed today because of an investigation by the office of the information commissioner, Richard Thomas.

Thomas, whose watchdog is entrusted with maintaining the public's privacy, believes Kerr has spent 15 years compiling and maintaining a huge database on 3,200 workers from around the country.

He alleges that Kerr, trading under the anodyne name of The Consulting Association, sold information from this database to construction companies who wanted to vet potential staff.

The end for Kerr's business came on Monday last week when Thomas sent his officials past the green door to raid the office. It caught Kerr unawares.

Thomas's officials took away the entire contents of the database, as well as invoices from companies in the construction industry which were paying Kerr.

The commissioner believes that these show the companies paid Kerr a flat fee of £3,000 a year and then a fixed fee for each name they wanted checked. He said invoices for up to £7,500 were discovered in the office.

Details of workers' trade union activities and past employment conduct were recorded on cards.

One individual was said to be a "poor timekeeper, will cause trouble, strong TU [trade union]". Another card referred to a member of the Union of Construction, Allied Trades and Technicians as "Ucatt ... very bad news".

A member of the Transport and General Workers Union was described as "a sleeper and should be watched". One entry on a worker simply said: "Do not touch !"

Sprinkled throughout the database were warnings of the confidentiality of the database; companies were told "do not divulge any of the above".

Kerr told the Guardian that he never gave advice or judgments to companies about whether to give a job to an individual as it was up to the firms to make the final decision.

He said prudent managers had a right to check who was being taken on and denied that it amounted to blacklisting. "There was nothing sinister about it. It was bona fide," he said.

It appears that Kerr has spent many years compiling databases on workers. He did not wish to comment on a report in the Guardian 15 years ago which said he had been working for the Economic League, a controversial vetting agency which accumulated files on thousands of people it considered subversive between 1919 and 1993.

The league disbanded after it was alleged that many of its files were inaccurate and so workers were unjustly being denied work.

Kerr's snooping career has been brought to an abrupt end by the information commissioner, who ordered him to stop. Kerr has agreed to wind up his business.

Yesterday David Smith, the deputy information commissioner, said: "This is a serious breach of the Data Protection Act.

"Not only was personal information held on individuals without their knowledge or consent, but the very existence of the database was repeatedly denied [by the industry].

"The covert system enabled Mr Kerr to unlawfully trade personal information for many years, helping the construction industry to vet prospective employees. Kerr held information on thousands of construction workers and profited by checking names against his database."

After closing down Kerr's business, the information commissioner is to prosecute him for breaking the Data Protection Act.

He has named more than 40 companies which he alleges bought "sensitive" personal data from Kerr and is considering further legal action to "stamp out this type of activity".

Many building firms did not wish to comment yesterday, but others did offer a reaction.

NG Bailey said: "We are taking these claims very seriously and an immediate and thorough investigation into the matter has been launched."

Laing O'Rourke said that, in recent years, it had bought up companies which had been paying Kerr. A spokesman said: "The relationship has now ceased. Laing O'Rourke has a very clear policy of solely hiring staff on merit and capabilities, irrespective of their background."

Morgan Est said it had also "inherited" Kerr's services. "This subscription has been terminated," it said.

Skanska said it had made payments to Kerr in the past, adding these services had not been used for blacklisting "to the best of our knowledge".

BAM Construct UK said it had been a "member of the Consulting Association", but "has never purchased or used 'blacklisting' data. We do not have a blacklist and we have never had a blacklist."

Ironically, the article publishes a list of those who have used the service.

http://www.guardian.co.uk/uk/2009/mar/0 ... protection
 
perhaps we need a covert database of dodgy consulting people that are approved (or blacklisted) for getting your bad data from :(
 
Well, the database is questionable. The accuracy of the data is prone. The security lapses have been reported often enough here, in fact staff in government departments are the worst in losing their cards. The attitude of Government EVEN if you take into account the decisions to sell your personal and medical details to private companies is ramshackle at best.

So what about the bit of plastic itself?



ID card 'flash and dash' warning

The first ID cards have been issued to foreign workers
The national identity card scheme could be "fatally" undermined by cheaply produced fake cards, a leading industry expert has warned.

Toby Stevens, of the Enterprise Privacy Group, believes a shortage of fingerprint scanners could lead to an explosion in "flash and dash" fraud.

And that, he says, could scupper the scheme before it gets off the ground.

But Mr Stevens, who is a leading adviser to the government on ID cards from the business lobby, fears the scheme could be scuppered before it gets off the ground by a black market in fake cards.

He said: "In the early days, private companies won't be aware of what an ID card is supposed to look like, nor will they have the equipment to check the cards electronically, so 'flash and dash' is inevitable.

"For this reason, there is already a black market in fake ID Cards, even though the design for UK nationals has yet to be decided."


http://news.bbc.co.uk/1/hi/uk_politics/7925779.stm

Apart from the plastic, I don't think anyone's seen a scanner yet for that matter but if the scanners are anything like chip n pin, someone will be playing Tetris on it within a week.
 
The retention of your data will cost you more and more...

Public could pay for many ID cards

The Home Office has admitted that the public would have to pay every time an ID card was damaged beyond use, despite the knowledge that ID cards are not expected to last the full 10 years, Mike Lowe reports.

Meeting minutes from the Chief Technology Officers (CTO) Council in November 2008 questioned the longevity of ID cards, noting that the NHS had to opt for a contactless alternative due to the deterioration of the original cards. In response, the CTO Council said the Identity and Passport Service (IPS) "expect the cards to be used robustly, so are not looking to issue the cards for the same length of time as a passport."

A spokesman for the Home Office dismissed the robust use theory, saying ID cards will be verified on a purely visual basis, with no requirement for the card to be handled on a regular basis. Speaking to Public Servant Daily, he said: "It's a form of identification, like a driving licence. It will not be as commonly used as a bank card, for example, but will sit in your wallet like a driving licence does, ready to be shown when necessary."

He also said ID cards were issued on a 10 year basis alongside a passport, and anyone who found his/her card had deteriorated beyond use would have to pay another £30 for a new card. Unless a citizen could prove that the reason for the card's faultiness was down to its manufacture, he added, then the citizen would have to pay for a replacement.

A spokesman for NO2ID said this was a classic example of left hand not knowing what the right hand is doing.

"This shows that senior civil servants are still not clear what ministers actually want from this project as the goalposts keep being moved," he said.

"Plans to have a biometric key on the card, which would then be swiped to access the data was found to be not feasible. A Chip and PIN system was found to be untenable. All the technology on which this project was sold to the public is now pointless and non-existent."

http://www.publicservice.co.uk/news_story.asp?id=8949
 
A small but important victory for anti- ID campaigners. According to the latest No 2 ID bulletin the government has backed down and dropped Clause 152 from the Coroners and Justice Bill. It seems some MPs have had upwards of 150 letters asking them to oppose it.

As for the lack of ID card scanners/ rise of fake ID/ doubts about the card technology, am I the only one who thinks the cards themselves are a total red herring?

The govt. can 'sell' ID cards to many folk as being useful for fighting Terrorism/ Benefit Fraud/ Illegal Immigration/Identity Theft/ Insert Daily Mail keyword of your own choice. This means we all go off arguing about that, and ignore the real purpose of it all; the database behind the scheme.

They don't care that the cards are a useless, expensive imposition on society, they don't want or need to read them. The threat to our civil liberties is not so much that we'll have to carry a tatty bit of plastic to use services, as that the Government and all its' agents will have access to every tiny detail of our lives. Forever. :x
 
Information is power, which is why the government wants it.
They want to have power over us, and not the other way round.

You're right PaganMoon, the database is what we should really fear, as it brings together all the diverse bits of information about us into one place.
Perfect for manipulation, and coincidentally a gift to fraudsters.
 
If in fact they can put any of it to use, seeing as the govt. has never been all that good at using technology on a wide scale. Seems like it'll be just another overly expensive bit of rubbish that's outdated by the time it's ready - if it ever is ready.
 
Jerry_B said:
If in fact they can put any of it to use, seeing as the govt. has never been all that good at using technology on a wide scale. Seems like it'll be just another overly expensive bit of rubbish that's outdated by the time it's ready - if it ever is ready.

I dunno about that. Orwell's vision of an efficient state was worrying enough. Slipshod practice and misuse of data will cause more inconvenience, harm or injustice than an efficient system.
 
That's if it ever gets off the ground. Anyone who's ever had any contact with the various arms of the Inland Revenue will have some idea about how 'efficient' govt. record and on-line systems are. And that's rather more simple in intent and scope than an ID database. Just don't ask the various departments to liase with each other - they don't! So somehow I can't see any of it working. The bits of data from various areas will probably stay where they are and never get anywhere near being a super-pool of information on all of us. I don't think any of it will get the chance to be organised enough to be then abused.
 
Jerry_B said:
That's if it ever gets off the ground. Anyone who's ever had any contact with the various arms of the Inland Revenue will have some idea about how 'efficient' govt. record and on-line systems are. And that's rather more simple in intent and scope than an ID database. Just don't ask the various departments to liase with each other - they don't! So somehow I can't see any of it working. The bits of data from various areas will probably stay where they are and never get anywhere near being a super-pool of information on all of us. I don't think any of it will get the chance to be organised enough to be then abused.

Oh that's alright then. Forget the efficiency of Orwell and let's go Kafka. You've put all my worries of a strange blend of an Orwellian state and a Kafkaesque nightmare at rest there. Except that strangely, all my concerns about mission creep and inaccuracy of data and the politicking of the police continues, as well as the extensive probing of the tech into our daily lives and the constant protests from civil liberties groups which continue on a several-times-daily-basis where it's hard to keep up. I know I'm boring you all with these updates but I'm trying my best to filter out what is relevant in regard to this being the most important issue we'll have to face in the next few years.

You say you can't see any of it working but it is working. Lobby groups promoting the technology have been represented in Parliament. And if you've been watching the news, you'd see a 'disgraced' peer evangelising an interested company behind the scenes. It is being implemented and since you last contributed to the thread, events have moved on to confirm the fears of not just 'lil ol paranoid me' but politicians, civil libertarians, and reporters and commentators from the media as well as the judiciary of the EU.

The fact is I don't think we can't afford your laissez-faire attitude when there's too much at stake. Data once given and stored in the manner they're collating is not safe, is insecure and it cannot be returned to the owner.

Besides all this, there's this weird empowerment of the police to look at ordinary activity through a looking glass of Big Brother.

Irony lesson which sort of proves the point...

Rarely has there been a more pathetic arrest than that of 23-year-old university student Paul Saville, who was confronted by four members of Britain's new breed of petty minded police officers after writing in chalk on a pavement, "Liberty: the right to question. The right to ask: 'Are we free?"'

With a wonderful lack of irony, the officers told him to stop writing. When he added one more letter they arrested him for criminal damage. The second year sociology and criminology student told the Daily Telegraph: "The whole reason I was writing in chalk was because I wanted to get my message across without causing lasting damage.

"I was merely highlighting the point that we are losing civil liberties in the UK," he added. "This is something we should be thinking about."


http://www.guardian.co.uk/commentisfree ... ce-protest
 
Well, I stand by what I've said. If any of it ever works in any concerted way I'll be very much surprised. But I'm not going to hold my breath about it. And I wouldn't say I have a laissez-faire attitude towards it - that would imply that I think any of it will ever work. Which I don't ;)
 
Jerry_B said:
Well, I stand by what I've said. If any of it ever works in any concerted way I'll be very much surprised. But I'm not going to hold my breath about it. And I wouldn't say I have a laissez-faire attitude towards it - that would imply that I think any of it will ever work. Which I don't ;)

They all laughed at Christopher Columbus
When he said the world was round
They all laughed when Edison recorded sound
They all laughed at Wilbur and his brother
When they said that man could fly

They told marconi
Wireless was a phony
It's the same old cry

...

But ho, ho, ho!
Who's got the last laugh now?


:wow:
 
Some news which could go on both this thread and the Police State thread...

A quarter of all the largest public-sector database projects, including the ID cards register, are fundamentally flawed and clearly breach European data protection and rights laws, according to a report published today.

Claiming to be the most comprehensive map so far of Britain's "database state", the report says that 11 of the 46 biggest schemes, including the national DNA database and the Contactpoint index of all children in England, should be given a "red light" and immediately scrapped or redesigned.

The report, Database State by the Joseph Rowntree Reform Trust, says that more than half of Whitehall's 46 databases and systems have significant problems with privacy or effectiveness, and could fall foul of a legal challenge.

Only six of the 46 systems, including those for fingerprinting and TV licensing, get a "green light" for being effective, proportionate, necessary and established - with a legal basis to guarantee against privacy intrusions. But even some of these databases have operational problems.

A further 29 databases earn an "amber light", meaning they have significant problems including being possibly illegal, and needing to be shrunk or split, or be amended to allow individuals the right to opt out. This group includes the NHS summary care record, the national childhood obesity database, the national pupil database, and the automatic number-plate recognition system.

Source

The number of databases used by the government and its related bodies and agencies appears to be overwhelming (300 inherited by SOCA ffs). No doubt a sustained amount of re-engineering could sort a lot of the problems - a properly maintained and secure government IT backbone is required.

However, I suspect that the number of private corporations suckling at the engorged teat of governmental IT contracts will quash any attempts for a sane and unified approach.
 
ContactPoint’s failure is a symptom of a wider disease
Murad Ahmed: Commentary
Technology moves fast. Governments do not. Those in the know are not in the least surprised that ContactPoint has been halted. The Government’s databases are in a mess.

A scathing report, published by the Joseph Rowntree Reform Trust yesterday, found that the most of the Government’s databases have “significant problems and may be unlawful”. ContactPoint was one of the systems said to be “fundamentally flawed”. ContactPoint’s failure is a symptom of a wider disease.

The problem is that the Government is rarely at the forefront of technological advances and therefore is liable to be sold shoddy goods. The report stated: “One noticeable effect is that the UK public sector always appears to get sold whatever technology or methodology is just going out of fashion in the private sector.”

Why does this happen? Because Government departments don’t have the staff. The public sector has outsourced so many of its IT contracts that it doesn’t have the experts to spot potential glitches.

A classic example was the failed Child Support Agency database. A damning Public Accounts Committee report in 2006 showed how the agency had handed over the project to its contractor, EDS, and failed to keep a close watch on it. This was in part because it did not have the in-house knowhow, because many of its IT staff had gone to work for EDS.

All of this will continue to happen as long as the Government continues to think that IT contracts and databases can be fully effective and 100 per cent secure. Some problems cannot be fixed with computers. The Rowntree report has the following advice for ministers: “If you think IT is the solution to your problem, then you don’t understand IT, and you don’t understand your problem either.”

http://women.timesonline.co.uk/tol/life ... 962874.ece

Back in the 60s, I worked for Marconi. One thing I picked up was that if you were thinking of computerising some system, a Systems Analyst was needed to study and re-organise the system - and it often turned out that this reorganisation on its own was all that was needed
- no computers were needed!
:D
 
Back
Top